Skip to content
OpenAdvisories
High WID-SEC-2026-4046 2 CVEs

Laravel: Mehrere Schwachstellen

Published Oct 19, 2026 · Updated Oct 22, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Laravel ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Daten zu manipulieren.

Product

Laravel ist ein in PHP geschriebenes Framework für Webanwendungen.

Vulnerabilities 2

  • Critical 9.2
    CVE-2026-114509 Public exploit Scanner template

    Laravel TokenGuard authentication bypass through non-string API credentials

    Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can matc…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • Medium 6.5
    CVE-2026-114508

    Laravel relationship inclusion can trigger unauthorized data destruction

    Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no w…

    laravel framework laravel/framework php-laravel-framework Debian Packagist

Revision history

  1. #2

    CVE aufgenommen + PoC CVE-2026-114509

  2. #1

    Initiale Fassung

References